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REMARKS/ARGUMENTS 

Claims 1-42 stand rejected, with claims 5,19 and 33 objected to in the outstanding 
Official Action. Applicants have cancelled without prejudice claims 3, 9, 17, 23, 31 and 37 and 
have amended claims 1, 5, 7, 11, 15, 19, 21, 25, 29, 33, 35 and 39. Accordingly, claims 1, 2, 4-8, 
10-16, 18-22, 24-30, 32-36 and 38-42 are the only claims remaining in this application. 

The Examiner has objected to handwritten text and graphics in Applicants' originally 
filed drawings. Applicants have submitted herewith replacement sheets with non-handwritten 
text and graphics. Entry and consideration of these replacement sheets of drawings is 
respectfully requested. 

The Abstract of the Disclosure is objected to and minor objections are made to the 
disclosure. Applicants have amended the Abstract to recite "An anti-computer virus system," to 
correct the spelling of "organization" and to delete "[Figure 3]." Consideration and entry of 
these corrections is respectfully requested. 

In section 4 of the Official Action, the Examiner has identified numerous instances of the 
British spelling for various words and suggesting that they be replaced with the American 
spelling for those words. While Applicants do not believe this to be a requirement since the 
present application is indeed in "English," nevertheless the suggested corrections have been 
made. 

Claims 5, 19 and 33 are objected to with respect to the spelling of the word 
"behavioural." Again, the English language spelling is correct, but in each instance has been 
changed to the American spelling of the word. Any further objection to claims 5, 19 and 33 is 
respectfully traversed. 
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Claims 3, 9, 17, 23, 31 and 37 have been rejected under 35 USC §112 (first paragraph 
and second paragraph). Applicants have cancelled without prejudice claims 3, 9, 17, 23, 31 and 
37, thereby obviating the rejections under 35 USC §112 (first paragraph and second paragraph). 

Claims 1,4, 6, 7, 11-15, 18,20,21,25-29, 32, 34, 35 and 39-42 stand rejected under 35 
USC §103 as unpatentable over "Norton Antivirus User's Guide" ("Norton") in view of 
"Combating Computer Viruses: IBM's New Computer Immune System" by Hedberg 
("Hedberg"). Norton discloses a system in which a user may manually specify a file to be 
quarantined, even though that file has not been identified as malicious by the anti-virus system 
itself. The file is quarantined by being encrypted such that it can no longer be used by the 
computer upon which it resides. 

The Examiner argues that Norton describes a user controlled mechanism for identifying a 
file to be banned from use. However, the Examiner acknowledges that the Norton system itself 
does not disclose a mechanism at the user computer to generate data for identifying the banned 
program using the anti-computer virus logic. This admission is in the Examiner's statement 
"Symantec lacks said banned program identifying data/encrypted suspected virus being operable 
to control anti computer virus logic to identify computer programs banned from use." (Official 
Action, page 5). 

Applicants note that the present invention relates to re-using the anti-virus mechanisms to 
enforce a banned computer program policy. The banned computer programs are not computer 
virus programs, but are merely undesired programs for various reasons as explained on page 1 of 
Applicants' specification as originally filed. Thus, in order to clarify the distinction between a 
virus program and a banned computer program, Applicants have offered an amendment to claim 
1 which specifies that "said at least one computer program comprising an undesired, non-virus 
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computer program." Inasmuch as Norton is concerned primarily with viruses (as is Hedberg), 
these references are not material to Applicants' independent claim 1. 

The Examiner also suggests that Hedberg discloses the use of automated mechanisms for 
generating virus signatures. The Examiner then concludes that it would be obvious to add the 
Hedberg automated mechanisms for generating virus signatures to the Norton system to avoid 
the slow process of manual virus signature generation. Actually, Applicants believe that one of 
ordinary skill in the art would not be motivated to make the combination as suggested by the 
Examiner. 

The Norton system teaches that as soon as the user adds the suspect file to the quarantine 
list, then that file is encrypted and is no longer available for use at that computer. As a result, 
after encryption, there is no outstanding problem for the user at that computer because the file 
has already been dealt with. There would be no reason to add computer virus signature 
generating mechanisms (as allegedly taught by Hedberg) to the computer, since the original 
computer is already protected from the suspicious file by virtue of the quarantine and encryption 
of that computer file. 

Even if the automatic virus signature generation mechanism (allegedly taught by 
Hedberg) were added to the computer, there would be nothing for the mechanism to detect, since 
the computer file which should be targeted has already been quarantined and subsequently 
encrypted. The Examiner's suggested motivation of eliminating the need for slower traditional 
analysis approach simply would not apply to a Norton system, since the quarantining mechanism 
of Norton has already protected the computer by encrypting the suspect file. 

As a result of the above, there is simply no reason one of ordinary skill in the art would 
think to try to combine aspects of the Norton and Hedberg teachings in the manner of 
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Applicants' independent claim 1. There is certainly no reason for someone to attempt combining 
these features so as to apply to an "undesired, non-virus computer program" as is set out in 
Applicants' independent claim 1. 

The claimed technique in the present application allows a user to generate their own 
computer virus definition data (DAT file) so as to allow them to prevent certain applications 
from running on their machine using the existing anti-virus mechanisms. Having internally 
generated this additional data relating to banned files (not virus files), this definition data may be 
distributed to other machines on a network or other distribution system so that policies on 
banned programs can be enforced throughout an entire organization. This beneficial 
functionality of Applicants' independent claim 1 is neither disclosed nor suggested in any of the 
prior art references. 

It is noted that the Court of Appeals for the Federal Circuit has consistently specified that 
the burden is on the Patent Office to establish some reason or motivation for combining 
references. Here, there is no motivation for even attempting to combine the Norton and Hedberg 
disclosures, let alone suggesting that such a combination could be used to identify a banned 
"undesired, non-virus computer program." In view of the Patent Office's failure to provide any 
evidence suggesting any reason or motivation for combining the references, coupled with the fact 
that even if combined, the references fail to teach the claimed computer program product, there 
is simply no support for any rejection of claims 1, 4, 6, 7, 11-15, 18, 20, 21, 25-29, 32, 34, 35 
and 39-42 under 35 USC §103 and any further rejection thereunder is respectfully traversed. 

Claims 2, 3, 8, 9, 16, 17, 22, 23, 30, 31, 36 and 37 also stand rejected under 35 USC §103 
as unpatentable over Norton in view of Hedberg in further view of Szor ("Bad IDEA") and 
Simpson ("Cryptography in Everyday Life"). Inasmuch as these claims depend ultimately from 
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independent claims 1, 15, 21, 29 and 35, the above comments with respect to the Norton and 
Hedberg references are herein incorporated by reference. Inasmuch as the claims from which 
they depend are believed patentable over the Symantec and Hedberg combination, the mere 
addition of Szor and/or Simpson does not cure the defect in the rejection. Accordingly, any 
further rejection of these claims under 35 USC §103 is respectfully traversed. 

Claims 5, 19 and 33 stand rejected under 35 USC §103 as unpatentable over Norton in 
view of Hedberg as previously applied and further in view of Veldman ("Heuristic Anti-Virus 
Technology"). Again, because each of these claims depends directly or indirectly from 
independent claim 1, claim 15 and claim 29, respectively, the above comments are herein 
incorporated by reference. Since Veldman does not supply any missing suggestion which would 
provide any motivation for combining the Norton and Hedberg references, adding Veldman to 
the combination does not render the independent claims or claims dependent thereon obvious in 
view thereof. Again, Veldman also fails to disclose any program identifying data relating to a 
banned program which is "an undesired, non-virus computer program." Therefore, any further 
rejection under 35 USC §103 is respectfully traversed. 

Claims 10, 24 and 38 also stand rejected under 35 USC §103 as unpatentable over the 
Norton/Hedberg/Szor/Simpson combination further in view of Davis (U.S. Patent 5,844,986). 
The patentability of claims 1, 21 and 35 has previously been discussed and those discussions 
with respect to the Norton, Hedberg, Szor and Simpson references are herein incorporated by 
reference. Again, Davis does not add any suggestion or motivation for combining the Norton 
and Hedberg references, nor is it believed to relate to the banning of an "undesired, non-virus 
computer program." Therefore, any further rejection of claims 10, 24 and 38 over the 
Norton/Hedberg/Szor/Simpson/Davis combination is respectfully traversed. 
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Having responded to all objections and rejections set forth in the outstanding Official 
Action, it is submitted that claims 1, 2, 4-8, 10-16, 18-22, 24-30, 32-36 and 38-42 are in 
condition for allowance and notice to that effect is respectfully solicited. In the event the 
Examiner is of the opinion that a brief telephone or personal interview will facilitate allowance 
of one or more of the above claims, he is respectfully requested to contact Applicants' 
undersigned representative. 



SCS:kmm 

1100 North Glebe Road, 8th Floor 
Arlington, VA 22201-4714 
Telephone: (703) 816-4000 
Facsimile: (703)816-4100 



Respectfully submitted, 




-24- 



910488 



TARBOTTON et al. 
Appl. No. 09/809,073 
December 21, 2004 



AMENDMENTS TO THE DRAWINGS 

Please substitute the attached four (4) sheets of replacement drawings for the drawings 
originally filed. 
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